An e-commerce enterprise hosts a public-facing web API on Google Kubernetes Engine (GKE) behind an HTTP(S) Load Balancer and stores sensitive transaction analytics in Cloud Storage and BigQuery. The security team needs to satisfy two core requirements: mitigate Layer 7 web application attacks (such as SQL injection) at the network edge, and prevent authorized users from copying internal datasets to external storage buckets outside the organization perimeter.
Which TWO security and perimeter controls should you implement to fulfill these requirements?
- Configure VPC Service Controls to establish a service perimeter around the Cloud Storage and BigQuery resources.Answer
- Apply Cloud Armor security policies with WAF rules to the backend service of the external HTTP(S) Load Balancer.Answer
- CRely strictly on fine-grained IAM roles to prevent authenticated users from writing data to external Cloud Storage buckets.
- DEstablish VPC Network Peering to route external API web traffic transitively through a centralized perimeter inspection network.
Answer
The two correct controls are establishing VPC Service Controls around Cloud Storage and BigQuery, and applying Cloud Armor security policies to the external HTTP(S) Load Balancer.
Establishing VPC Service Controls builds a perimeter around storage and analytics services to block unauthorized data transfers outside the project boundary. Deploying Cloud Armor security policies on the external HTTP(S) Load Balancer protects GKE web applications against Layer 7 threats like SQL injection at the network edge.
Step-by-Step Solution
Key Concept
Combining Cloud Armor for edge WAF protection and VPC Service Controls for data exfiltration prevention.